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WHAT IS CLAIMED IS: 

1 1 . A method for generating traffic information for analysis, the method 

2 comprising: 



3 a) accepting at least one sample derived from addressed data; 

4 b) determining path-centric information based on the accepted at least 

5 one sample; and 

6 c) adjusting a traffic metric of a traffic parameter based on the determined 

7 path-centric information. 



1 2. The method of claim 1 wherein the addressed data is a packet. 

1 3. The method of claim 1 wherein the sample includes information from the 

2 header of a packet. 

1 4. The method of claim 1 wherein the act of determining path-centric information 

2 based on the accepted at least one sample includes using at least a part of the at 

3 least one sample as a search key to find an item with a closest matching key in a 

4 data structure. 

1 5. The method of claim 4 wherein the data structure is a searchable data 

2 structure selected from a group consisting of (A) a hash table, (B) a binary 

3 search tree, and (C) a trie. 

1 6. The method of claim 1 wherein the act of determining path-centric information 

2 based on the accepted at least one sample includes: 

3 i) using at least a part of the at least one sample as a search key to 

4 find a first item with a closest matching key in a first data structure; 

5 and 

6 ii) using at least a part of the first item found as a search key to find 

7 a second item with a matching key in a second data structure. 
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1 7. The method of claim 6 wherein the second item includes path-centric 

2 information, 

1 8. The method of claim 6 wherein the second item includes an origin 

2 autonomous system and a peer autonomous system. 

1 9. The method of claim 6 wherein the second item includes an autonomous 

2 system path. 

1 10. The method of claim 6 wherein the first and second data structures are tries. 

m 1 11. The method of claim 6 wherein the first data structure is a Radix trie. 

1° 1 12. The method of claim 6 wherein the at least a part of the at least one sample 

m 2 used as a search key is an internet protocol prefix. 

fll 1 1 3. The method of claim 6 wherein the at least a part of the at least one sample 

m 2 used as a search key is at least one of (A) a source address and (B) a 

3 destination address. 

1 14. The method of claim 6 wherein the at least a part of the first item found used 

2 as a search key is an autonomous system index. 

1 15. The method of claim 1 wherein the sample includes at least two parameters 

2 selected from a group parameters consisting of (A) a source address, (B) a 

3 destination address, (C) a protocol, (D) a source port, (E) a destination port, (F) 

4 an interface number, (G) a type of service, (H) an SNMP index, (I) a kernel 

5 logical interface index, and (J) a type of interface indice. 
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1 16. The method of claim 1 wherein the path-centric information determined 

2 includes an origin autonomous system and a peer autonomous system. 

1 17. The method of claim 1 wherein the path-centric information determined 

2 includes an autonomous system path. 

1 18. The method of claim 1 wherein the act of adjusting a traffic metric of a traffic 

2 parameter based on the determined path-centric information includes: 



3 i) using a part of the determined path-centric information as a key 

4 to search items of traffic parameters; 

5 ii) if a traffic parameter with a matching key is found, incrementing 

6 its traffic metric; 

7 iii) if none of the traffic parameters has a matching key, creating a 

8 new item. 



1 19. The method of claim 1 wherein the traffic metric adjusted is at least one of 

2 (A) a byte count and (B) a packet count. 

1 20. The method of claim 1 wherein the traffic parameter is selected from a group 

2 of traffic parameters consisting of (A) a particular pair of source and destination 

3 addresses, (B) a particular pair of source and destination ports, and (C) a 

4 particular pair of autonomous systems. 

1 21 . A method for generating data structures for mapping information in a sample 

2 derived from addressed data, to path-centric information, the method comprising: 



3 a) using network information, building a first data structure including items 

4 of a first type, each of the items of the first type including an autonomous 

5 system index and an internet protocol prefix, wherein the internet protocol 

6 prefix is a key; and 

7 b) using network information, building a second data structure including 

8 items of a second type, each of the items of the second type including an 
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9 autonomous system index and an autonomous system path, wherein the 

10 autonomous system index is a key. 

1 22. The method of claim 21 wherein the first and second data structures are 

2 tries. 

1 23. The method of claim 21 wherein the first data structure is a Radix trie. 

1 24. The method of claim 21 wherein the network information was derived from 

2 routing information. 

1 25. An apparatus for generating traffic information for analysis, the apparatus 

2 comprising: 



3 a) an input for accepting at least one sample derived from addressed 

4 data; 

5 b) means for determining path-centric information based on the accepted 

6 at least one sample; and 

7 c) means for adjusting a traffic metric of a traffic parameter based on the 

8 determined path-centric information. 



1 26. The apparatus of claim 25 wherein the means for determining path-centric 

2 information based on the accepted at least one sample include a searching 

3 facility, the search facility (i) using at least a part of the at least one sample as a 

4 search key to find a first item with a closest matching key in a first data structure, 

5 and (ii) using at least a part of the first item found as a search key to find a 

6 second item with a matching key in a second data structure. 

1 27. The apparatus of claim 26 wherein the second item includes path-centric 

2 information. 
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1 28. The apparatus of claim 26 wherein the second item includes an origin 

2 autonomous system and a peer autonomous system. 

1 29. The apparatus of claim 26 wherein the second item includes an autonomous 

2 system path. 

1 30. The apparatus of claim 25 wherein the means for adjusting a traffic metric of 

2 a traffic parameter based on the determined path-centric infonnation include 



3 i) a search facility, using a part of the determined path-centric 

4 information as a key to search items of traffic parameters; and 

5 ii) an aggregator, wherein if a traffic parameter with a matching key 

6 is found, the aggregator increments the traffic metric of the traffic 

7 parameter, and wherein if none of the traffic parameters has a 

8 matching key, the aggregator creates a new item. 



1 31 . The apparatus of claim 25 wherein the traffic parameter is selected from a 

2 group of traffic parameters consisting of (A) a particular pair of source and 

3 destination addresses, (B) a particular pair of source and destination ports, and 

4 (C) a particular pair of autonomous systems. 

1 32. A data forwarding device comprising: 



2 a) an addressed data fonvarding facility for fonwarding addressed data 

3 based on forwarding information; 

4 b) a routing facility for determining and disseminating network state 

5 information, and for generating path information based on the network 

6 state information; 

7 c) a sampler for generating samples based on accepted addressed data; 

8 d) means for determining path-centric information based on the samples 

9 generated by the sampler; and 

10 e) means for adjusting a traffic metric of a traffic parameter based on the 

11 detemnined path-centric information. 
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1 33. The data forwarding device of claim 32 wherein the routing facility effects a 

2 exterior gateway protocol. 

1 34. The data forwarding device of claim 32 wherein the routing facility effects a 

2 border gateway protocol. 

1 35. A data forwarding device comprising: 

2 a) an addressed data forwarding facility for forwarding addressed data 

3 based on forwarding information; 

4 b) a routing facility for determining and disseminating network state 
CI 5 information, and for generating path information based on the networl^ 
S 6 state information; 

If 7 c) means, using the path information generated by the routing facility, for 

i 8 building a first data structure including items of a first type, each of the 
J^J 9 items of the first type including an autonomous system index and an 

'i^ 10 internet protocol prefix, wherein the internet protocol prefix is a key; and 

ii 11 d) means, using the path information generated by the routing facility, for 
J»{ 12 building a second data structure including items of a second type, each of 
0 13 the items of the second type including an autonomous system index and 

14 an autonomous system path, wherein the autonomous system index is a 

15 key. 

1 36. The data forwarding device of claim 35 further comprising: 

2 e) a sampler for generating samples based on accepted addressed data; 

3 f) means for determining path-centric information based on (i) the 

4 samples generated by the sampler, (ii) the first data structure, and (iii) the 

5 second data structure; and 

6 g) means for adjusting a traffic metric of a traffic parameter based on the 

7 determined path-centric information. 
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1 37. A machine-readable medium having stored thereon: 



2 a) a first data structure including items of a first type, each of the items of 

3 the first type including an autonomous system index and an internet 

4 protocol prefix, wherein the internet protocol prefix is a key; and 

5 b) a second data structure including items of a second type, each of the 

6 items of the second type including an autonomous system Index and an 

7 autonomous system path, wherein the autonomous system index is a key. 



1 38. The machine-readable medium of claim 37 wherein the first and second data 

2 structures are tries. 

1 39. The machine-readable medium of claim 37 wherein the first data structure is 

2 a Radix trie. 

1 40. The machine-readable medium of claim 37 further comprising: 

2 c) network information derived from routing information. 
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